Setup Server 2003 to route incoming traffic

Forgot to add

I would set the router up infront of your dhcp server.

Have one interface go to your dmz, or 192.x.x.x
have the other interface go to the Firewall, 10.x.x.x

Didn't have an icon for a firewall,  just used a router, but lableled it Firewall

i believe v-jushaw has given a perfect diagram for your scenario.

if the "Firewall" in the above diagram is a W2K3 based host, and the clients want to RDP from the 192 network to the specific hosts on the 10 network without seeing any other thing and without "without purchasing a router", i think what you need to do is to enable ICS on the W2K3 server, and enable port forwarding for RDP on ICS.

FYI

How To Set Up Internet Connection Sharing in Windows Server 2003
http://support.microsoft.com/kb/324286

the following KB is for forwarding PPTP traffic, the same for RDP except the port number, from 1723 to 3389.

How to Configure Windows XP ICS for an Internal PPTP Server
http://support.microsoft.com/kb/309524

additionally, please be aware that if you enable ICS for the internal existing 10 network, the automatic IP addresses will be changed to 192.168.0.0/24, by default. if your internal clients are all using DHCP, that should not be a problem.

hope it helps,
bbao

Thanks for the help.  I figured buying a router would be the solution, but I thought I might as well try to avoid it.  In the case of the above diagram, what should the router's internal IP be set to?  Or will it matter?  Thanks

It's a good idea to buy a router. Some are not that expensive, some are.

But, it's always best to route over a router than a server. I have seen to many errors with mutihoming a computer and then putting RRAS on it for routing.

according to your security requirements, it should not be a common router, a firewall (ACL/NAT based router) instead.

using ICS is actually a NAT based solution. of course, you may choose a hardware based router.

the router/firewall's internal IP should be on that 10 subnet. for default ICS settings, it should be 192.168.0.0 subnet.

hope it helps,
bbao

I just realized that as well..

I have a Linksys firewall / router and a strictly firewall Watchguard firewall, which won't be able to port forward of course.

I would like much stricter security on the 10 network still.  Is there a good way to use these two pieces of equipment to do this, or will I need a second router / firewall combo?

which model is your Linksys firewall/router? i think most Linksys models can do port forwarding.

You are correct, the Linksys one can.  

The question is, will I be able to port forward directly to my server and not the Watchguard firewall?  Or will I first have to forward it to the firewall, and let it handle it, then pass it on to the server?  For example,

Let's say my server's internal IP is 10.0.0.10.  Can I login to the router and set it up to port forward 3389 (defautl RDP port, will definitely not use the default..) and have it forward to 10.0.0.10?  Or will I need to forward to my Watchguard firewall at 10.0.0.1 from the Linksys?

not quite understand what you said.

where is the Watchguard firewall? this was the first time it appeared in the thread. were you talking abou the "2811 router1" in the diagram?

I assumed the 2811 firewall branching off of the 2811 router to be the Watchguard firewall.  Was this intended to be a router / firewall combination?  My reasoning for using the Watchguard in addition is

1) create a separate IP / subnet
2) It's a much more advanced firewall and will have many security features the Linksys will not.

I'm more familiar with Cisco routers, which you could configure more than one interface.

With this router you could configure 1 interface for your 192.168.0.0/24 network
and the other interface with your 10.0.0.0\24 network.

The router based on incoming connections would direct traffic to the proper interface.
Then on your watchguard firewall, open the port for RDP.

The firewall will only need to either allow or deny traffic

its router capabilities if it has any should be disabled.

You would still follow my first network diagram that I posted

i don't see any problem with a Linksys router in implementing port forwarding. the same for Watchguard routers. just use any of the existing ones, you can do it.